Introduction:
The year 2023 in cybersecurity was a testament to resilience amidst a storm of digital threats. Organizations of all sizes faced a surge in ransomware attacks, with cybercriminals deploying more sophisticated tactics. The urgency for stringent cybersecurity measures and adherence to evolving regulations has never been more pronounced.
The Drill Down:
The year 2023 will go down in cyber history as an epoch of unparalleled cybercrime, with ransomware at its zenith. Businesses across the spectrum, irrespective of size or industry, found themselves at the mercy of cybercriminals, enduring financial hemorrhages that ran into the billions. The nefarious evolution of hacking techniques saw the advent of compound extortion strategies—tripling down on encryption, data theft, and coordinated network debilitation.
IBM's annual report paints a grim picture, pegging the average data breach cost in the U.S. at a staggering $9.48 million. Phishing scams and compromised credentials topped the charts as the leading culprits behind these breaches. Looking forward, the cyber threat landscape is poised for further turbulence with the advent of advanced AI tools like WormGPT and FraudGPT, which promise to augment the efficacy of phishing campaigns, bespoke malware creation, and the pinpointing of system weaknesses, potentially escalating both the frequency and severity of cyber attacks in 2024.
These malicious attacks grew not only in sophistication but also in their aggressive demands, with some cybercriminals resorting to violence threats against those who resisted paying ransoms. The frequency of these incursions soared by 95% from the previous year, with Corvus Insurance reporting a staggering increase in incidents. The financial toll of ransomware also surged, with the average demanded payout reaching $1.54 million, as noted by Sophos in their annual review. If current trends persist, we could see ransomware damages climb to an astonishing $265 billion by the year 2031. Vulnerabilities were exposed across all sectors, with no industry impervious to the threat, affecting a wide range of targets including legal, healthcare, financial, and educational institutions. Alarmingly, educational institutions have emerged as particularly susceptible, with primary and secondary schools increasingly bearing the brunt of these cyber extortions.
Amid the rising tide of cybercrime, there has been a concurrent surge in cybersecurity regulations at both the federal and state levels. Notably, the U.S. Securities and Exchange Commission (SEC) has implemented stringent cybersecurity disclosure rules. Similarly, the Federal Communications Commission has enhanced its data breach notification requirements. A standout move comes from the New York Department of Financial Services (NYDFS), which has significantly broadened its cybersecurity regulations. This expansion includes a new mandate for a 72-hour report on ransomware attacks and cybersecurity incidents, along with a 24-hour notification requirement for any cyber extortion payment, complemented by a detailed report within 30 days justifying the necessity of such payments.
While the cybersecurity community eagerly anticipates the Department of Defense's finalization of the Cybersecurity Maturity Model Certification (CMMC) rules, affecting all defense contractors, the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency is also on the brink of unveiling its proposed rules to implement a 72-hour cyber incident reporting requirement. This mandate, applicable to all critical infrastructure organizations, falls under the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) and is slated for release by March 2024.
Further bolstering the regulatory landscape, the Department of Health and Human Services (HHS) has unveiled its 2024 Cybersecurity Initiative. This initiative aims to ramp up cybersecurity requirements for hospitals and healthcare organizations. It encompasses the introduction of new cybersecurity mandates for hospitals and updates to the Health Insurance Portability and Accountability Act (HIPAA), integrating additional cybersecurity measures. These developments mark a significant step in enhancing the overall resilience of crucial sectors against the ever-escalating threat of cyberattacks.
The recent announcement by the Department of Health and Human Services (HHS) underscores the heightened vulnerability of the healthcare industry to cyber threats. Over the past five years, the sector has seen a staggering 93% increase in significant data breaches. The year 2023 alone witnessed over 300 publicly reported ransomware attacks on healthcare institutions, signaling a dire need for reinforced cybersecurity measures.
One of the most notable incidents of 2023 occurred in November when Ardent Health Services, operating 30 hospitals and over 200 healthcare facilities across six states, fell victim to a ransomware attack. This cyber assault led to a near-total shutdown of its hospitals, necessitated the diversion of ambulances, and posed a substantial threat to public safety.
In tandem with the rollout of its Cybersecurity Initiative, HHS made a significant announcement on December 7, 2023. This pertained to its first settlement concerning a 2021 phishing attack that breached the data of nearly 35,000 patients and resulted in HIPAA violations at the Louisiana-based Lafourche Medical Group (Lafourche). The group agreed to pay $480,000 and implement a corrective action plan, which includes two years of rigorous monitoring. This case, where hackers accessed an email account containing the electronic health information of tens of thousands, highlighted Lafourche's failure to perform a risk analysis essential for identifying threats to sensitive health information.
This landmark settlement is a clear indicator of HHS's commitment to a more proactive and stringent role in scrutinizing healthcare organizations' cybersecurity practices. With this increased focus on compliance and accountability, healthcare institutions are urged to fortify their cybersecurity controls to prevent such breaches and the resulting severe legal and financial repercussions.
The regulatory landscape in 2023 marked a significant shift towards stringent enforcement of cybersecurity regulations by the Securities and Exchange Commission (SEC) and the Federal Trade Commission (FTC). This shift underscores a growing focus on protecting the public from inadequate cybersecurity measures and deceptive corporate disclosures regarding data breaches and privacy infringements.
In a notable development, Amazon consented to a $30 million settlement with the FTC over charges related to privacy and cybersecurity concerns involving Alexa and Ring devices. In another case, Blackbaud, a cloud computing provider, was fined $3 million by the SEC. This penalty was imposed for misleading statements Blackbaud made regarding a 2020 ransomware attack, claiming that personal information of their charitable donors, such as social security numbers and bank account details, was not compromised when, in fact, such sensitive data had been accessed and extracted by hackers.
These incidents illustrate the growing risks faced by corporations in the realm of cybersecurity enforcement. The concern extends beyond organizational liability to personal accountability for corporate executives. The Department of Justice (DOJ) and SEC have signaled a clear intent to hold executives responsible for cybersecurity noncompliance. A landmark example of this was the case against Uber’s former Chief Security Officer, Joseph Sullivan. In a groundbreaking move, the DOJ pursued a 15-month prison sentence for Sullivan, marking the first instance of a corporate executive facing criminal prosecution for concealing a data breach. Though Sullivan was not incarcerated as requested by the DOJ, his conviction in October 2022 for obstructing justice and misprision of a felony serves as a stark warning to corporate insiders. It underscores the DOJ's readiness to seek incarceration for those who opt to hide cybersecurity failings and deceive federal officials. This heightened regulatory focus and the accompanying legal actions demonstrate the critical need for corporations to rigorously implement and comply with cybersecurity regulations. The era of lax cybersecurity practices and unaccounted breaches has ushered in a new phase of accountability, where both organizations and their executives must navigate a complex and demanding cybersecurity compliance landscape.
After the Civil Cyber Fraud Initiative was introduced in October 2021, which highlighted the Department of Justice's (DOJ) concerns about government contractors not reporting breaches, there have been four notable settlements under this initiative. A key example occurred in September 2023, when DOJ reached a $4 million settlement with Verizon Business Network Services LLC. This settlement was due to the company's failure to adequately implement cybersecurity controls for an information technology service provided to federal agencies. Besides these actions, 2023 was marked by five other significant developments in the field.
SEC Issues New Rules on Public Disclosure of Cyber Incidents
The SEC has brought charges against SolarWinds and its Chief Information Security Officer, Timothy Brown, for fraud and failures in internal controls. On October 30, 2023, the SEC filed a civil complaint against the company and Brown, causing a significant stir in corporate security circles. These charges are connected to accusations of misrepresenting cyber risks and internal control shortcomings, along with securities fraud linked to a complex supply chain cyberattack on SolarWinds' Orion network management software (“SUNBURST”), reportedly orchestrated by a foreign government. This marks the first instance where the SEC has held a corporate individual responsible for cybersecurity failings or misleading cybersecurity information, signaling a new direction in holding individuals directly accountable for cybersecurity breaches and false disclosures.
According to the SEC, between October 2018 and January 12, 2021, SolarWinds and Brown deceived investors and clients by downplaying and hiding the company's weak cybersecurity measures and growing cyber threats. The company is accused of providing investors with only general and hypothetical information about cybersecurity risks, while Brown and the company were aware of specific vulnerabilities, inadequate cybersecurity controls, and heightened risks compromising SolarWinds' security stance. Despite being aware of these issues and questioning the company's ability to safeguard its critical assets, Brown allegedly did not rectify or address these shortcomings. Furthermore, after the SUNBURST attack came to light, SolarWinds' disclosures in its Form 8K filing were allegedly incomplete and misleading.
Lawyers Sanctioned for Relying Upon ChatGPT to Conduct Legal Research
In June 2023, a U.S. District Court in New York penalized lawyers Steve Schwartz and Peter LoDuca for submitting court documents based on fabricated judicial opinions and quotes produced by ChatGPT. Despite being alerted by the opposition about the non-existence of these citations, the lawyers persisted in their claims. This led to a significant ruling by Judge P. Kevin Castel, who deemed their conduct as acting in bad faith and imposed a $5,000 fine on them and their firm. This incident, and a similar case in Colorado involving attorney Zachariah C. Crabill, has prompted courts to consider rules for disclosing AI usage in legal research.
These events are part of a larger scrutiny of AI tools in legal contexts. The EU's recent AI Act and ongoing investigations by the SEC and FTC into AI usage, including an inquiry into OpenAI by the FTC in July 2023, highlight the growing concern over the ethical use of AI in professional practices.
DOJ Cracks Down on Crypto: Binance's CEO Leads Pack with Guilty Plea
Shortly after Sam Bankman-Fried, founder of FTX, was convicted of a major fraud, Changpeng Zhao, founder of Binance, the world's largest cryptocurrency exchange, pleaded guilty to not implementing an effective anti-money laundering program and resigned as CEO. Binance admitted to several charges, including conspiracy and operating as an unlicensed money transmission business, agreeing to pay a $4.3 billion fine. The U.S. Department of Justice (DOJ) highlighted that Binance had processed billions in illegal trades, including for terrorists and other criminal activities. A three-year monitoring period was included in the DOJ's settlement with Binance.
In July 2023, the DOJ announced an intensified focus on criminal investigations related to cybercrime and cryptocurrency misuse, emphasizing the frequent illegal uses of cryptocurrency. This includes North Korea's use of stolen cryptocurrency to fund its weapons program. The cases against Bankman-Fried and Zhao signal the DOJ's commitment to prosecuting crimes involving advanced technology.
Russian Ransomware Group Weaponizes Zero-Day Exploit
In May 2023, a cyberattack by the Russian ransomware group CLoP exploited a previously unknown vulnerability in the MOVEit Transfer tool by Progress Software. Despite a swift response from Progress Software with a patch, CLoP managed to access the personal data of over 65 million individuals globally, impacting more than 2,000 organizations, including New York City’s public schools and various private companies. This breach resulted in numerous class-action lawsuits and is considered the most significant data theft of 2023.
Following this incident, the U.S. Securities and Exchange Commission (SEC) initiated an investigation into Progress Software, issuing a subpoena in October 2023. While this doesn't automatically imply a forthcoming civil complaint, it indicates the SEC's increased scrutiny on the company's internal controls, corporate governance, and public disclosures, especially in relation to cybersecurity.
Main Points and Lessons Learned:
- The complexity of ransomware and phishing attacks has underscored the need for advanced threat intelligence and proactive defense strategies.
- Regulatory compliance has become a centerpiece in the cybersecurity policies of organizations, with an emphasis on real-time incident reporting and robust cybersecurity controls.
- The implementation of CMMC 2.0 signifies a pivotal shift towards a standardized cybersecurity framework for defense contractors, highlighting the need for a unified approach to protect critical information.
- Lawyers prove that they are stupid susceptible to blindly relying on AI to prepare motions.
Why This Matters:
The implications of 2023's cybersecurity developments are far-reaching, affecting not only the immediate security posture of organizations but also shaping the future of cyber law, international policy, and global cybersecurity collaboration.
Advice for Readers:
Organizations should invest in cybersecurity training, embrace a risk-based approach to security, and stay abreast of regulatory changes to maintain compliance and enhance their defensive capabilities.
Conclusion:
As we step into the future, the lessons from 2023 will inform the strategies and policies that organizations adopt. With a clear focus on threat intelligence, regulatory compliance, and cross-sector collaboration, the cybersecurity community continues to strengthen its defenses against an ever-evolving threat landscape.
References:
- IBM’s 2023 Cost of Data Breach Report - [IBM's official website]
- Cybercrime Magazine on ransomware costs - [Cybercrime Magazine's official website]
- SEC’s new cybersecurity disclosure rules - [SEC's official website]
- CMMC 2.0 rollout details - [Department of Defense's official website]
- Judge finds out why brief cited nonexistent cases—ChatGPT did research [Read More]